eagle0/.github/workflows/installer_build.yml

name: Installer Build

on:
  push:
    branches: [ "main" ]
    paths:
      - ".github/workflows/installer_build.yml"
      - "src/main/go/net/eagle0/clients/win/installer/**"
  pull_request:
    paths:
      - ".github/workflows/installer_build.yml"
      - "src/main/go/net/eagle0/clients/win/installer/**"
  workflow_dispatch:

permissions:
  contents: read
  actions: write  # Required to delete artifacts after deploy

jobs:
  build-installer:
    runs-on: [self-hosted, bazel]

    steps:
      - uses: actions/checkout@v4
        with:
          lfs: false
          clean: false

      - name: Build Go installer for Windows
        env:
          MANIFEST_PUBLIC_KEY: ${{ secrets.MANIFEST_PUBLIC_KEY }}
        run: |
          # Require manifest public key for production builds
          if [ -z "$MANIFEST_PUBLIC_KEY" ]; then
            echo "ERROR: MANIFEST_PUBLIC_KEY secret is not set"
            echo "The installer requires a public key for manifest signature verification"
            exit 1
          fi

          # Build Windows installer with WebView GUI (uses CGO cross-compilation)
          # Use --action_env to pass the signing key into the genrule sandbox
          bazel build //src/main/go/net/eagle0/clients/win/installer:eagle_installer_windows_amd64_webview --stamp --action_env=MANIFEST_PUBLIC_KEY

          # Copy to output directory
          rm -rf ./installer-output
          mkdir -p ./installer-output
          cp bazel-bin/src/main/go/net/eagle0/clients/win/installer/Eagle0.exe ./installer-output/Eagle0.exe

          echo "Go installer size: $(ls -lh ./installer-output/Eagle0.exe | awk '{print $5}')"

      - name: Archive installer binary
        if: success() || failure()
        uses: actions/upload-artifact@v4
        with:
          name: eagle-installer
          path: ./installer-output/
          retention-days: 1

      - name: Verify installer exists
        if: success()
        run: |
          echo "=== Installer output directory ==="
          ls -lh ./installer-output/

          if [ ! -f "./installer-output/Eagle0.exe" ]; then
            echo "ERROR: Eagle0.exe not found"
            exit 1
          fi
          echo "Installer found"

      - name: Deploy installer
        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
        env:
          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
          SECRET_KEY: ${{ secrets.SECRET_KEY }}
        run: |
          INSTALLER_PATH="$(pwd)/installer-output/Eagle0.exe"
          echo "Deploying Go installer to installer/Eagle0.exe"
          bazel run //src/main/go/net/eagle0/build/installer_build_handler:installer_build_handler -- "$INSTALLER_PATH" "installer/Eagle0.exe"

      - name: Update manifest
        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
        env:
          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
          SECRET_KEY: ${{ secrets.SECRET_KEY }}
          MANIFEST_SIGNING_KEY: ${{ secrets.MANIFEST_SIGNING_KEY }}
        run: |
          INSTALLER_SHA=$(sha256sum ./installer-output/Eagle0.exe | cut -d' ' -f1)
          echo "installer_version=$INSTALLER_SHA" > /tmp/installer_manifest.txt
          echo "installer_url=installer/Eagle0.exe" >> /tmp/installer_manifest.txt

          echo "=== Manifest content ==="
          cat /tmp/installer_manifest.txt
          echo "========================"

          # Write signing key to temp file (if available)
          SIGNING_ARGS=""
          if [ -n "$MANIFEST_SIGNING_KEY" ]; then
            echo "$MANIFEST_SIGNING_KEY" > /tmp/manifest_signing_key
            chmod 600 /tmp/manifest_signing_key
            SIGNING_ARGS="/tmp/manifest_signing_key"
            echo "Manifest signing key available"
          else
            echo "Warning: MANIFEST_SIGNING_KEY not set, manifest will be unsigned"
          fi

          # Update the v2 manifest at installer/v2/eagle0_manifest.txt
          bazel run //src/main/go/net/eagle0/build/manifest_manager:manifest_manager -- installer-v2 /tmp/installer_manifest.txt $SIGNING_ARGS

          rm -f /tmp/manifest_signing_key

      - name: Delete all installer artifacts
        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # Delete ALL eagle-installer artifacts to free up storage
          echo "Fetching all eagle-installer artifacts..."
          artifact_ids=$(gh api "repos/${{ github.repository }}/actions/artifacts" \
            --paginate -q '.artifacts[] | select(.name == "eagle-installer") | .id')
          for id in $artifact_ids; do
            echo "Deleting artifact ID: $id"
            gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$id" || true
          done
          echo "Cleanup complete"